Error using layer7 on floating rule

marcogi

Hello,
I'm experimenting errors using layer7 on floating rules.
Tested on 2.0-RELEASE and on 2.2.4-RELEASE with similar behavior.
I get the following messages in /var/log/system.log

on pfSense-2.0-RELEASE
Oct 26 13:32:40 pfSense ipfw-classifyd: unable to write to divert socket: Host is down

on pfSense-2.2.3-RELEASE
Oct 26 09:46:18 pfSense ipfw-classifyd: unable to write to divert socket: Operation not permitted

The filter rules are:

On LAN
pass in quick on em0 all flags S/SA keep state

Floating:
pass out on em1 proto tcp/udp all divert 52048

ipfw-classifyd runs as:
/usr/local/sbin/ipfw-classifyd -n 8 -q 700 -c /tmp/l7test.l7 -p 52048 -P /usr/local/share/protocols

If I set the layer7 on LAN interface rule, everything works fine.
The above errors are for packets classified to pass by ipfw-classyfyd at the sendto() call to reinject them into IP stack.
The layer7 filter I set does not look to be relevant.

Is the above an expected behavior?
Did anybody already see similar errors? I searched the forum with no luck.

Thanks for the help.
marco

doktornotor

You must be the first one for whom "everything works fine". L7 has been completely unusable with 2.2.x…

https://redmine.pfsense.org/issues/4276

marcogi

I'm actually using/testing 2.0-RELEASE and "everything works fine" on it. Sorry for the confusion.
I picked the last release to reproduce the problem with floating rules. Didn't realize layer7 was broken on 2.2

I just made the same test with 2.1.5-RELEASE and got

Oct 27 06:33:12 pfSense ipfw-classifyd: unable to write to divert socket: Host is down

with layer7 container on floating rule. While layer7 container on LAN rule works as expected.

On 2.0-RELEASE the "Host is down" is 64 EHOSTDOWN.

doktornotor

I don't think you'll have much luck trying to get help with prehistoric releases. Noone's using them.

marcogi

Well, my question was if that were a problem which has been ever seen and/or fixed in some newer release.